fix: derive refresh test freshness epochs from the clock

[gabrielspadon]

What broke

RefreshEngine.run compares the bound discovery policy epoch against its own wall clock (citeforge/refresh/engine.py:116), and derives the inventory task epoch from that same clock (engine.py:142). Ledger.commit_initial_round then requires the inventory authority to agree with the bound discovery policy (citeforge/refresh/ledger.py:4463).

Four tests in tests/test_refresh_discovery.py wrote the literal month they were authored in ("2026-08"), so they agreed with the engine for exactly one calendar month. When the clock rolled to 2026-09 the engine started deriving 2026-09 while the bound policy still said 2026-08, and all four began raising:

ValueError: inventory authority conflicts with bound discovery policy

That is a test-only defect. No production code path pins a month, and the monthly workflow derives its own with date +%Y-%m.

Blast radius

Every Test (py3.10 … py3.14) leg failed identically, which failed the Required CI aggregate and left PR #52 (a Dependabot uv bump touching only requirements-build.in and .lock) BLOCKED on a failure it did not cause. Any PR opened after 2026-09-01 would have been blocked the same way.

Fix

Both engine-driving test modules derive the epoch exactly as the engine does. The staleness test builds its rejected month as an explicit offset from today rather than naming one.

Two guard tests were also passing on the right status for the wrong reason. test_generation_start_binds_discovery_preflight_before_inventory_send was tripping the epoch mismatch instead of the missing s2 credential it exists to prove. Both it and the staleness test now pin the exact detail string their guard must return, so a guard that starts firing for a different cause fails instead of passing silently.

test_no_refresh_test_pins_a_literal_freshness_epoch fails on any double-quoted YYYY-MM literal in a test_refresh_*.py module that drives RefreshEngine, so this cannot be reintroduced. Single-quoted months inside the SQL of test_refresh_corpus.py write a deliberately mismatching epoch to trip a drift guard and are correctly left alone.

Verification

Run locally on Python 3.14.7 against origin/main.

• Reproduced first: the same 4 failures, same ValueError, before any edit.
• pytest -m 'not live' (CI's exact invocation): 2077 passed, 2 skipped, 7 deselected.
• ruff check citeforge/ tests/ main.py: clean.
• mypy citeforge/ main.py: clean, 56 source files.
• The four previously-detonating tests re-run under a simulated 2027-02 clock: all pass, confirming the time coupling is gone rather than merely re-pinned to the current month.
• The new guard was proved to fail by reintroducing a literal into test_refresh_discovery.py, then restored.

Merging this unblocks #52.